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Specifications of the Address checker 
for MEGA DRIVEs 


SEGA ENTERPRISES, LTD. 
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Specifications 
To use the MAIN-CPU to access access-prohibit areas, which is necessary during the 
development of software for the MEGA DRIVE (hereafter referred to as "MD" ) and MEGA-CDs 


(hereafter referred to simply as "CD"), and to check whether data written to the various 
registers is correct. 


When an error has occurred, the address, data and program counter in question can be 


indicated with the LEDs or displayed on the display along with the R/W, UDS and LDS statuses. 
(CPU operations are stopped during displaying. ) 


of various parts and 


1 Names of parts 


Display (Indicates address, data and the program counter) 


Operation-indicating LEDs 
(From left to right: data, 
program counter, address, 
power, R/W, LDS and UDS) 
Power source selection SW 
(Used to select the internal 
power source or and external 
power source) 

Left: AC adaptor (SA-160A) 
Right: CPU (MEGA-CDs) 

Input terminal for external 
power source 


the address checker) 


SWI 
sed to display data) 
SW2 


o display the 
program counter ) 


ALT is released when 
nd SW2 are pressed 
taneous ly. 


M5128 
C P U68000( 12.5 MH.) 


2 DIP Switches : initial settings and functions 


a a Ld 


12 3 4 


ON 
FF 


. 1 ON—— Switches the unit to normal operations from address checker operations without 
having to plug a different connector in the CPU socket. 
O F F— The unit functions as an address checker. 
.2  ON-— Checks addresses in the MD mode. 
O F F— Checks addresses in the CD mode. 
.3 Not used 
.4 Not used 


chy 


2-3 How to operate 
@® Plug the address checker into the MD's CPU socket. 
@ Run the software. (Confirm that the unit's power LED is on. ) 


@ If operations are not halted even after all routines in the program have been run, 
this can be interpreted as indicating that there are no access- inhibits, etc., in the 
program 


@ If operations are halted, look at the display and LEDs to determine the status of the 
program. - 


(5) Then press SW] and SW2 simultaneously to resume execution of the program beginning at the 
address after the one where the error occurred. 


Note: To deliberately stop the CPU and display the current address, data and program counter when 
no error has occurred, move DIP switch | to "ON" start the unit and press SW? after the 
desired location has been reached. To release this stop, press SW! and SW2 simu! tanously 


and release SW2 first, then SW]. 


2—4 Interpreting the display and LEDs during operations 


@ When the main unit and MD(with CD) are turned on, all LEDs and the entire display come on 
during resetting of the CPU. Once resetting is completed, all LEDs except for the power 


LED go out. 


@ When an error occurs, first the error address appears in the display (six digits). 
When SWI is pressed, the error data is displayed as long as the button is held down 


(lower four digits). 
When SW2 is pressed, the value of the program counter when the error occurred is 


displayed as long as the button is down (six digits). 
@ LEDs(These indicate the 1/0 status of the CPU when an error has occurred. ) 
On : Indicates that the unit was in the write state 


Off: Indicates that the unit was in the read state. 


On : Indicates that the lower-half of the data bytes have been input/output. 
Off: Indicates that the lower half of the data bytes have not been input/output. 


On : Indicates that the upper half of the data bytes have been input/output. 
Off: Indicates that the upper half of the data bytes have not been input/output. 


Note: 

# Both LDS and UDS come on during word access. 

* As the 68000's running program counter register contains the value of the next operation, 
the cause of the error may actually be indicated by a value prior to the PC(Program counter ) 
down. 

The address checker only checks mapping and the value entered in the register: 
it is not a function for finding bugs in the program. 
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3. ltems checked with 


3-1 Mapping 


this 


device 


When the MAIN-CPU accesses one of the disabled areas shown below, an error is displayed and 


the MAIN-CPU is halted. 


MD mode 


$000000 j 
ROM 
cartridge 


$200000 
BACK-UP 


$204000 
PROHIBITED 
Z80 


$A00000 


$A10000 


ie. | 
$A11000 
CONTROL 


$A12000 
PROHIBITED 
per 


$C00000 
PROHIBITED 
WORK RAM 


3-2 Register settings 


$E00000 


$FFO0000 
$FFFFFE 


CD mode 

$000000 
$020000 
$040000 

PROHIBITED 
$200000 

WORD-RAM 
$240000 

PROHIBITED 
$600000 


BACK-UP 
$800000 
PROHIBITED 


$A00000 
Z80 
Five | 


$A10000 
CONTROL 
MAIN REG. 
PROHIBITED 


ver 


PROHIBITED 
WORK RAM 


$A11000 


$A12000 


$A12030 


$C00000 


$E00000 


$FF0000 
$FFFFFF 


When data other than an accepted value is written to a register, an error is displayed and 
the MAIN-CPU is halted. Please refer to Attachment 5, "Table of Register Settings,” for 
the settinas of the VDP and MAIN-CPII reoicsters 


SEER ee ot ak PEN SENT) My a eT, ok eee ee eee 


4. An example of analysis using an ICE 


Caution: 
As the system. is halted when. during analysis with and ICE, and error occurs and the 


address checker is activated, when reading the history, etc., carry out analysis after first 
stopping the program and pressing SW! and SW2 simultaneously to release the stop. 
4-1 An example of analysis: (1) address error 


@Access address (before pressing SW2) : 000004 _ 


(QPC address (when pressing SW2) : 0018FC 

(DLED(s) that come on : UDS, LDS, R/W 

1 :HD (History dump) 

Point T Address St Data Mem Opcode Operand 

0021 0018EC 41F80000 SP LEA.L $000000. W, AO 

0019 0018F0 43F8FE12 SP LEA.L $FFFE{2.W, Al 

0017 0018F4 217C000980000004 SP MOVE.L #$00098000, $0004(A0) 
0012 wi 000004 MW 0009 SD 

0011 000006 MW 8000 ae) 

0013 (PC1)0018FC 237C000980000000 SP MOVE.L #$00098000, $0000(A1) 


2 :HM (History map) 
tr1,2 : The part where the address checker error occurred. 
(PC1,2): The part of the address checker displayed by the PC. 


Point T Address St Data Mem 


0021 0018EC MR 41F8 SP a LEA.L $000000. W, AO 
0020 0018EE MR 0000 SP 

0019 0018F0 MR 43F8 SP = LEA.L = $FFFEI2. W, Al 

0018 0018F2 MR FE12 SP 

0017 0018F4 MR 217C SP 

0016 0018F6 MR 0009 SP MOVE.L #$00098000, $0004(A0) 
0015 0018F8 MR 8000 SP 

0014 0018FA MR 0004 SP 

0013 (PC2)0018FC MR 237C SP ——— MOVE.L 

0012 2 000004 MW 0009 SD 


Cause: Data was written to the ROM area. 
In locations #1 and 2, "0009" has been written to address $000004 (point 12). 


In the MD address map, $000000 to $OFFFFF is ROM area and therefore read-only. Therefore, the 
address checker caused an error. 


When looking at the HM, we see that as for the program, before the error occurred there was a 
read cycle for reading the instruction in address 18F4. 


The H D shows us that while the instruction in $0018FC was the source of the error, in the H M the 
instruction in $0018FC was read before this instruction was executed (i.e., prefetch). The checker 
therefore shows this value. This is because until an error occurs the address checker displays as 

the PC value only the last program address it stored. 
3 : Reverse assembly/source program 


== Supervisor Program Memory == 


ADDRESS CODE Mnemonic 

001 8EC 41F80000 LEA.L $000000. W. AO :A0<—$000000 
0018F0 43F8FE12 LEA.L $FFFE(2.W, Al 

0018F4 2170000980000004 MOVE.L #$00098000, $0004(A0) :ROM AREA WRITE 
00) 8FC 237C000980000000 MOVE.L #$00098000. $0000(A1) 


4-2 An example of analysis: (2) register setting error 


@Access address : C00004 
(2Data (when SW! has been pressed) : 8008 
(PC (when SW2 has been pressed) =: O601A8 


@LEDs that come on : UDS, LDS and R/W 
1 :HD (History dum) 
Point T Address St Data Mem Opcode Operand 
0014 06019E 207C00C00004 “SP MOVEA.L #$00C00004, AO 
001! 0601A4 30BC8008 SP MOVE.W #$8008, (A0) 
0008 +1 c00004 MW 8008 SD 
0009 (PC1) 0601A8 30BC8124 SP MOVE.W #$8124, (AQ) 
wr1.2  : The part where the address checker error occurred. 
2 :HM (History map) (PC1,2): The part of the address checker displayed by the PC. 


Point T Address St Data Mem 


0014 06019E MR 207C SP 

0013 0601A0 MR 00CO SP MOVEA.L #$00C00004, AO 
0012 0601A2 MR 0004 SP 

0011 0601A4 MR 30BC SP =f MOVE.W #$8008, (A0) 
0010 0601A6 MR 8008 SP 

0009 (PC2) O601A8 MR 30BC SP ——— MOVE. W 


0008 +2 C00004 MW 8008 SD 
Cause: Data was written to a disabled register. 
In wf and 2, "8008H” has been written in address $C00004 (Point 8). 
In the table of MD register settings, the data 8008H listed as not authorized. The address 
checker therefore caused the error. 
3 : Reverse assembly/source program 
== Supervisor Program Memory == 


ADDRESS CODE Mnemonic 


06019E 207C00C00004 MOVEA. L #$00C00004, AO :A0<-$C00004 
0601A4 30808008 MOVE.W #$8008, (AQ) :VDP RGSTR SET 


4-3: An example of analysis: (3) address setting error 


@Access address 


(DAddress setting data (before pressing SW2) : 4010 


@PC (when SW2 is pressed) 
@LEDs that come on 


1:HD (History dum) 


Point T Address 
0016 06149E 
0010 c00004 


0009 wi C00006 
0011 (PCi) 0614A8 


2 :HM (History map) 


Point T Address 
0016 06149E 
0015 0614A0 
0014 0614A2 
0013 0614A4 
0012 0614A6 
OO11 (PC2) 0614A8 
0010 C00004 


0009 x2 C00006 


: 0614A8 
: UDS, LDS, R/W and 2nd 


St Data Mem Opcode Operand 
23FC4000401000C00004 SP MOVE.L #$40004010, $c00004. L 
MW 4000 : -SD 
MW 4010 SD 
20388388 SP MOVE.L $FFB3B8. W, DO 


wri.2 : The part where the address checker error occurred. 
(PC],2): The part of the address checker displayed by the PC. 


St Data Mem 


MR 23FC SP 

MR 4000 SP 

MR 4010 SP MOVE.L #$40004010, $C00004. L 
MR 00CO SP 

MR 0004 SP 

MR 2038 SP ——— MOVE.L 

MW 4000 SD 

MW 4010 SD 


Cause : Setting data for a disabled address has been written. 


In x1 and 2, "$4010H" has been written to address $C00004. (Point 9) 


In the table of MD address register settings, the data therefore caused the error. 


3: DI (reverse assembly/source program) 


== Supervisor Program Memory == 


ADDRESS CODE 


O6149E  23FC4000401000C00004 MOVE.L #$40004010, $co0004. L 


Mneumonic 


;ADRS RGSTR SET 


J r 


5. Appendix 
5-1 Table of VDP register settings 
5-2 Table of VDP address settings 
5-3 Table of MAIN-CPU register settings 


Note: 


#5-1. and 5-2 are tables of settings used in both the MD and CD modes: 5-3 shows settings used 
only in the CD mode. (in the MD mode, the settings in 5-3 are access-prohibit areas. ) 


+In the MD and CD modes, use of VDP register#23 causes partial change in the DMA’s source 
address. 


tIn 5-3, "Table of MAIN-CPU register settings,” bit F in $A12000(#rest, halt) and bit 2 in 
$A12002 (#mmode, write protect) were originally zero but changed to "don’t care” as the checker 
would otherwise stop at their location in the CD's BOOT-ROM. 
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5 — 1 Table of VDP register settings 


VDP reg. #0 ($C00004) 
MSB LSB 


VDP reg. #1 ($0004) 
MSB LSB 


NAN G4 Roa Re fet Reo | 0 buwfieo [mi [wz [as] 0 [ 0 | 
BIT ojofofrlo]x ae 
VDP reg. #2 ($C00004) 
MSB LSB 
Nan | 1 | 0 | 0 Rc4 pes hz fot hoo | 0 | 0 arseargsaig] 0 | 0 | 0 | 
sit | tfofololololrfolofolx]x[xfofofo 
wx? os | 2 Toms | oe | 
VDP reg. #3 ($C00004) 
MSB LSB 
naw | 1 | 0 | 0 Roa Res fez ht hoo | 0 | 0 porgordioigiordry| 0 
eT tfofololofols{+/sfolx|x|x]x|x]o| 
VDP reg. #4 ($C00004) 
NAME 
BIT 
HEX 
VDP reg. #5 ($C00004) 
NAME 
BIT 


HEX 


VDP reg. #6 ($C00004) 
MSB LSB 


wwe [1 Jo [ooops fo] To [oT [elo] oo 
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VDP reg. #7 ($C00004) 
MSB LSB 


ae 


VDP reg. #8 ($C00004) 
MSB LSB 
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VDP reg. #9  ($c00004) 
MSB LSB 


NAME 


BIT 


HEX 


VDP reg. #10 = ($C€00004) 


MSB LSB 
[2 | @ od ps oz fo fon ures ig 
tfofefets}olsfolx]xfx]x|x]x]x] x] 
a ee ee 


NAME 


BIT 


HEX 0-F O-F - 


VDP reg. #11 ($C00004) 
MSB LSB 


[+ [© | o fea fis oz pot fon ['o [0 [0 | o fee rsd se 
pao] ) eet aie fa eel ex] 


NAME 


BIT 


HEX 0-7 
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VDP reg. #12 ($C€00004) 


Note: Set PCH2=RS40 (bit pattern) 


VDP reg. #13 ($C00004) 
MSB LSB 
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VDP reg. #14 ($C00004) 
MSB 


NAME 
BIT 


HEX 


VDP reg. #15 ($C00004) 
MSB LSB 


NAME 


[Te [= ee fe Fs reacted 
SOOORDDO0RRR0000 


BIT 


HEX O-F O-F 


VDP reg. #16 ($C00004) < 
MSB LSB 


1 [| © fe os fz pot eo | o | 0 fszihszd | 0 fsziisg 
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NAME 
BIT 


HEX 


VDP reg. #17 ($C00004) 
MSB 


NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


NAME 
BIT 


HEX 


NAME 
BIT 
HEX 


NAME 
BIT 


HEX 


NAME 
BIT 
HEX 


VDP reg. #18 ($C00004) 
MSB LSB 


[1 [2 | @ Ps fs fe fs fon pon o | rvs 
ee ne DERERE DEAE 


O-F 


VOP reg. #19 ($C00004) 
MSB LSB 


et eo bet bot Los fot boo fz Jot fn 
Se eee 


O-F 


BOD 
Boon 


VDP reg. #20 ($C00004) 
MSB LSB 


VDP reg. #21 = ($C00004) 


VDP reg. #22 ($C00004) 
MSB LSB 


BOOGOOOGOGcGicucoE 


O-F 


a th a rem a eal eT 


ee 


NAME 


BIT 
HEX 
BIT 
HEX 


NAME 
BIT 
HEX 
BIT 
HEX 


NAME 
BIT 
HEX 


NAME 
BIT 


HEX 


NAME 
BIT 


HEX 
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VOP reg. #23 ($C00004) DMA #ROM TO VRAM 


VDP reg. #23 ($C00004) DMA #BACK-UP TO VRAM 
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VDP reg. #23 ($C00004) DMA WORK-RAM TO VRAM 
MSB LSB 
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VDP reg. #23 ($C00004) DMA #FILL VRAM/VRAM COPY 
MSB LSB 


1 [2 |e sz foo bao spuodazzb acaba atop 
eo Olea fe || [|] el oa) 
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VDP reg. #23 ($C00004) OMA sWORD-RAM TO VRAM ( Only CD mode) 
MSB LSB 


1 [2 | fe sz pt co wo spuopazzbc azo bar ebay 
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5 —2 Table of VDP address settings 
CRAM READ _ ($C00004) 
MSB upperWORD LSB 


bt foes zt fo [a9 [8 [7 [as [45 [4 [a [2 [a [0 
ofefeofofofofolololx]x|x]x]x]x]x, 
ee ae 


NAME 


BIT 


HEX 0-F 


MSB lowerWORD LSB 


NAME 
BIT 


HEX 


CRAM WRITE ($C00004) 
MSB upperWORD LSB 
NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


MSB upperWORD LSB 
NAME 
BIT 
HEX 


NAME 
BIT 
HEX 
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NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


VRAM READ ($C00004) 
MSB upperWORD LSB 


VRAM WRITE ($C00004) 
MSB upper WORD LSB 


MSB upperWORD LSB 


EAEIEEIEAEAEIES 


O-F 


MSB lowerWORD LSB 


NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


NAME 
BIT 
HEX 


VSRAM READ ($C00004) 
MSB upperWORD LSB 


ra] [|] o] [a [9 
EIESEIEAESEIEAES 
Pear | 


O-F 


VSRAM WRITE _ ($c00004) 
MSB upper WORD LSB 
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VRAM COPY ($C00004) 


MSB upper WORD LSB 


5 — 3 Table fo MAIN-CPU register settings 


$A12000_ #RESET, HALT 
MSB LSB 


ined o | o [0 | o[ 0 | o fncbneg 
BROR ROGER 


NAME 
BIT 


HEX 


$A12002 4MMODE, WRITE PROTECT 


MSB LSB 
NAME 
BIT 
HEX 

$A12004 ¥#CDC MODE (READ ONLY) 

( Error:byte data was read in address $A12005) 

MSB LSB 
NAME 
BIT 
HEX 

$A12006_ +#H-INT VECTOR (WORD ACCESS) 

MSB LSB 
NAME 
BIT 
HEX 

$A12008  +CDC HOST DATA (READ ONLY , WORD ACCESS) 

MSB LSB 
NAME 
BIT 
HEX 

$A1200C_ +#STOP WATCH (READ ONLY , WORD ACCESS) 

MSB LSB 
we [To] 0 ro or soo fo 
on foo fale fala) x] x] xe xb fx 
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$A1200£ 4COMMUNICATION FLAG (READ ONLY . WORD ACCESS) 


( Error:byte data was written in address $A1200F) 
MSB LSB 


LFA FS5CFSACFSICFSOCFSICFSO 


$A12010-—$A1201£E  ¥COMMUNICATION COMMAND (WORD ACCESS) 


$A12020-—$A1202E  +COMMUNICATION STATUS (READ ONLY . WORD ACCESS) 


